Welcome to ShareYourAI (hereinafter referred to as "the Platform" or "we"). These Terms of Service (hereinafter referred to as "the Terms") constitute a legally binding agreement between you (hereinafter referred to as "User" or "you") and the Platform. By using the Platform, you agree to be bound by these Terms. If you do not agree, please do not use the Platform.
1. Definitions
In these Terms, the following expressions have the meanings set out below:
- "Service" refers to the AI knowledge assistant creation, management, and sharing platform provided by ShareYourAI, including but not limited to document uploading, AI conversations, share links, appearance editing, and API access.
- "User Content" refers to all files, documents, data, and other content you upload to the Platform, including but not limited to PDF, Word, Excel, plain text, Markdown, and HTML files.
- "AI Output" refers to the responses, summaries, and analysis results generated by the Platform's AI system based on your User Content and queries.
- "Knowledge Base" refers to the structured knowledge dataset formed after your User Content is processed by the Platform (including document parsing and vector embedding).
- "Share Page" refers to a page you create through the Platform that generates a public link, allowing visitors to interact with your AI assistant without registration.
- "Subscription Plan" refers to the service tiers offered by the Platform, including Free, Pro, and Business plans.
2. Acceptance and Modifications
By using the Platform, you acknowledge that you have read, understood, and agreed to all provisions of these Terms. The Platform reserves the right to modify these Terms at any time. Upon modification, we will notify you via email or in-platform notifications. If you continue to use the Service after modifications, you are deemed to have accepted the modified Terms. If you do not agree to the modified Terms, you should immediately stop using the Service.
3. Account and Registration
The Platform uses Google OAuth for authentication, requiring no separate registration process.
- Signing in with your Google account automatically creates a Platform account. The Platform will obtain your Google account name, email address, and profile picture.
- You are responsible for maintaining the security of your Google account. All activities conducted through your account are deemed to be your actions.
- Each user may only create one account. The Platform reserves the right to suspend or delete accounts found to be in violation.
- You warrant that the account information you provide is truthful and accurate.
4. Service Description
ShareYourAI is a RAG (Retrieval-Augmented Generation) knowledge management platform. Core features include:
- Document Upload and Knowledge Base Creation: Supports uploading documents in PDF, Word, Excel, CSV, TXT, Markdown, and HTML formats. The system automatically parses and creates a vectorized knowledge base.
- AI Conversations: Provides intelligent Q&A services powered by AI technology (Google Gemini) based on your knowledge base.
- Share Links: Generates public share pages that allow visitors to interact with your AI assistant without registration.
- Smart Presentations: Transforms PDF documents into interactive presentations with AI conversation support (Pro plan and above).
- Appearance Editor: Customize the branding, colors, and layout of your share pages.
- API Access: Provides an OpenAI-compatible API interface to integrate AI capabilities into your applications (Pro plan and above).
- The Platform may add, modify, or discontinue features at any time, with reasonable notice to users.
5. Subscription Plans and Payment
5.1 Plan Description
The Platform offers three subscription plans: Free, Pro, and Business. Feature limitations and quotas for each plan are detailed on the Platform's pricing page, which forms part of these Terms.
5.2 Payment Processing
Paid plans are processed through PCI DSS compliant third-party payment service providers, and the Platform does not store your complete credit card numbers. Supported payment channels (credit card, ATM transfer, convenience-store codes, etc.), encryption, and protection details are described in the "Data Security" page (Payment Security section); the current payment service provider is listed in the "Privacy Policy" Section 4.1. We may add or change PCI DSS compliant payment service providers from time to time and will notify you via in-platform announcement or email before any change takes effect.
5.3 Billing and Renewal
Paid plans renew automatically on the subscription date according to the billing cycle you choose (monthly or yearly). The billing currency is automatically set based on your region upon first login (USD or TWD) and cannot be changed by the user; if the Platform later detects that the initial assignment does not match your actual region, it may correct the billing currency automatically.
5.4 Refund Policy
The Platform does not generally offer proactive refunds. You may cancel your subscription at any time, and the plan will be downgraded to the Free plan at the end of the current billing cycle. Exceptions: if a charge results from a system error, duplicate charge, or other technical fault attributable to the Platform, we may issue a refund through the payment service provider, either proactively or after you contact customer support. We recommend exploring the Free plan thoroughly before upgrading.
5.5 Plan Upgrades and Downgrades
Upgrades take effect immediately with instant access to new features. Downgrades take effect at the end of the current billing cycle. Resources exceeding the new plan's limits (AIs, share pages, API keys, etc.) will be suspended but not deleted. Upgrading back to the original plan will restore all suspended resources.
6. User Content and Intellectual Property
- Ownership: You retain all intellectual property rights to the User Content you upload. The Platform does not claim ownership of your User Content.
- Limited License: You grant the Platform a non-exclusive, worldwide, limited license to use, process, and store your User Content solely for the purpose of providing the Service (including but not limited to document parsing, vector embedding, AI retrieval, and response generation).
- AI Output: You may freely use AI-generated responses based on your knowledge base to the extent permitted by law. The Platform does not guarantee the accuracy, completeness, or suitability of AI Output.
- Legality Warranty: You warrant that the content you upload is legally owned by you or that you have obtained proper authorization, and that it does not infringe upon any third party's intellectual property rights, privacy rights, or other rights.
- Platform IP: The Platform's software, designs, trademarks, technology, and other intellectual property are owned by the Platform. You may not copy, modify, or distribute them without written authorization.
7. AI Service Special Terms
- Accuracy Disclaimer: AI-generated responses are produced based on the knowledge base documents you provide and may contain inaccurate or incomplete information. AI Output does not constitute professional advice (including but not limited to legal, medical, financial, or technical advice).
- Processing Method: Your content goes through document parsing, vector embedding, retrieval, and AI generation; the specific technical steps and data flow are described in the "Privacy Policy" Section 3.2.
- Third-Party AI Model: The Platform uses a third-party AI model (currently Google Gemini) as its underlying AI service. Your queries and the relevant document fragments are sent to the provider's API while requests are processed and are subject to that provider's terms of service and privacy policy.
- No Model Training: The Platform will not use your User Content or conversation records to train AI models.
- Usage Responsibility: You should independently assess the suitability of AI Output and bear full responsibility for any decisions or actions taken based on AI Output.
8. Acceptable Use Policy
When using the Platform, you must not:
- Upload any content that violates the laws of the Republic of China (Taiwan) or your local jurisdiction, including but not limited to content infringing intellectual property rights, pornography, violence, hate speech, or other illegal content.
- Use the Platform to distribute false information, fraudulent content, or malware.
- Reverse engineer, decompile, or attempt to hack or breach the Platform's systems.
- Use automated tools to mass crawl or scrape the Platform's data or content.
- Use AI assistants created through the Platform for illegal activities or actions that harm others' rights.
- Circumvent or attempt to circumvent the Platform's usage limits, quota controls, or security mechanisms.
- Impersonate any person or misrepresent your affiliation with any person or organization.
Upon discovering violations of the above rules, the Platform may immediately suspend or delete the relevant accounts and content without prior notice or refund.
9. Third-Party Services
The Platform relies on third-party cloud services and SaaS providers for full functionality (covering authentication, AI models, payments, file storage, database, vector database, and similar). The complete current list of providers and the categories of data each one processes are described in the "Privacy Policy" Section 4.1. By using the Platform, you agree to the respective terms of service and privacy policies of those providers.
The Platform is not responsible for the availability, accuracy, or security of the above third-party services. The Platform bears no liability for impacts caused by third-party service interruptions or changes.
10. Disclaimers
- The Service is provided on an "as is" and "as available" basis. The Platform makes no express or implied warranties regarding uninterrupted service, error-free operation, security, or fitness for your particular purpose.
- The Platform does not guarantee the accuracy, completeness, reliability, or timeliness of AI Output. AI responses may contain errors or outdated information.
- The Platform does not guarantee that you will achieve any specific business objectives or results through the Service.
- The Platform bears no liability for service interruptions or losses caused by force majeure events, including natural disasters, war, government actions, cyberattacks, or other circumstances beyond reasonable control.
11. Limitation of Liability
To the maximum extent permitted by law:
- The Platform shall not be liable for any indirect, incidental, special, consequential, or punitive damages, including but not limited to loss of profits, data loss, goodwill damage, or business interruption.
- The Platform's cumulative liability for any damages arising from the Service shall not exceed the total fees actually paid by you to the Platform in the 12 months preceding the event giving rise to the damage.
- The above limitations do not exclude any statutory rights that cannot be excluded under the laws of the Republic of China (Taiwan).
12. Indemnification
You agree to indemnify and hold harmless the Platform and its personnel and partners from any claims, damages, losses, or expenses (including reasonable attorney's fees) arising from:
- Your violation of any provision of these Terms.
- Your uploaded content infringing any third party's rights.
- Any illegal conduct in your use of the Service.
13. Term and Termination
- To delete your account, please contact us at [email protected] (self-service account deletion is not yet available). Upon account deletion, all your data (including AIs, knowledge documents, conversation records, and share pages) will be permanently removed. This action is irreversible.
- The Platform may suspend or terminate your account access for violation of these Terms or other reasonable grounds.
- After account termination, you must stop using the Service. Provisions regarding intellectual property, disclaimers, limitation of liability, and general terms shall survive termination.
- If the Platform decides to cease operations, we will notify users at least 30 days in advance and provide a reasonable data export period.
14. General Provisions
- Governing Law: These Terms shall be governed by and construed in accordance with the laws of the Republic of China (Taiwan).
- Jurisdiction: Any disputes arising from these Terms shall be submitted to the Taiwan Taipei District Court as the court of first instance.
- Severability: If any provision of these Terms is found to be invalid or unenforceable, the remaining provisions shall remain in full force and effect.
- Entire Agreement: These Terms (together with the Privacy Policy and pricing page content) constitute the entire agreement between you and the Platform, superseding any prior oral or written agreements.
- No Waiver: The Platform's failure to exercise or delay in exercising any right under these Terms shall not be deemed a waiver of such right.
- Non-Transferability: You may not assign or transfer any rights or obligations under these Terms to any third party without the Platform's written consent.
ShareYourAI (hereinafter referred to as "the Platform" or "we") takes your privacy very seriously. This Privacy Policy explains how we collect, use, store, share, and protect your personal data, as well as the rights available to you. This policy applies to all your interactions with the Platform's services.
1. Information We Collect
1.1 Information You Provide
- Account Information: Name, email address, and profile picture obtained through Google OAuth sign-in.
- Payment Information: Credit card and payment details processed through PCI DSS compliant payment service providers (currently TapPay) for paid subscriptions. The Platform only stores encrypted tokens returned by the processor along with the last four digits and card type; complete credit card numbers are never stored.
- User Settings: Preferences you configure on the Platform, including language settings, AI configurations, and appearance customizations.
- Feedback: Comments and issue descriptions submitted through the Platform's feedback feature.
1.2 Content You Upload
- Knowledge Documents: Files you upload in PDF, Word, Excel, CSV, TXT, Markdown, HTML, and other supported formats.
- Conversation Content: Message records from your conversations with AI assistants.
- AI Configuration Data: Role names, instructions, and response templates you set for your AI assistants.
1.3 Automatically Collected Information
- Device Information: Browser type, operating system, screen resolution.
- Usage Records: Login times, feature usage frequency, page view history.
- IP Address: Used for security verification and region determination.
- Cookies and Similar Technologies: Used to maintain login sessions and preference settings (see Section 5 for details).
2. Purpose of Data Collection
In accordance with Article 8 of the Personal Data Protection Act of the Republic of China (Taiwan), we inform you of the specific purposes for collecting your personal data:
- Service Provision: Account creation and management, AI knowledge base construction and conversation services, share link functionality.
- Payment Processing: Subscription billing and invoice management.
- Security Protection: Preventing unauthorized access, detecting anomalous behavior, protecting the Platform and user safety.
- Service Improvement: Analyzing usage trends, improving features and user experience.
- Customer Communications: Sending service notifications, billing notices, important updates, and feature changes.
- Legal Compliance: Fulfilling obligations required by the laws of the Republic of China (Taiwan), including tax reporting and compliance with court orders.
3. How We Use Your Information
3.1 Service Provision
We use your account information for authentication and account management, and use your uploaded documents to build knowledge bases and provide AI conversation services.
3.2 AI Processing Workflow
Your uploaded documents undergo the following processing workflow:
- Document Parsing: The system parses document content into text.
- Chunking: Text content is split into appropriately sized segments.
- Vector Embedding: Each segment is converted into mathematical vectors through embedding models and stored in the Qdrant vector database.
- Retrieval and Generation: When users ask questions, the system retrieves the most relevant vector segments, which are sent along with the query to the Google Gemini API for response generation.
Please note: Data sent to the Google Gemini API is governed by Google's privacy policy. We only send the minimum data necessary to answer the question.
3.3 Analytics and Improvement
We may use de-identified aggregate data to analyze service usage trends and improve features and user experience. We do not use your personal conversation content for marketing or advertising purposes.
4. Information Sharing and Disclosure
We do not sell your personal data. We only share your information in the following circumstances:
4.1 Third-Party Service Providers
We use the following third-party services, which may process some of your information:
- Google (OAuth authentication, Gemini AI model) — Processes your account information and conversation queries.
- TapPay (payment processing) — Processes your credit card and multi-channel payment information, including charges and refunds. TapPay is a PCI DSS-compliant Taiwanese payment service provider. We may add or change payment service providers from time to time and will notify you before any change.
- Cloudflare R2 (file storage) — Stores your uploaded original documents.
- Supabase / AWS (database) — Stores your account data, conversation records, and related settings. The database is located in the AWS Tokyo, Japan region.
- Qdrant Cloud (vector database) — Stores vectorized embedding data from your documents.
4.2 Legal Requirements
When required by law or by judicial authority orders, we may need to disclose your information, including but not limited to responding to court subpoenas, search warrants, or government investigations.
4.3 Business Transfers
In the event of a merger, acquisition, or asset sale of the Platform, your information may be transferred as part of the transaction. We will notify you before the transfer and ensure the receiving party maintains privacy protection standards equivalent to this policy.
4.4 With Your Consent
Outside the circumstances described above, we will seek your explicit consent before sharing your personal data.
5. Cookies and Tracking Technologies
The Platform uses three categories of cookies and similar technologies — strictly necessary, functional, and first-party analytics — to keep you signed in, remember preferences, and improve the service. We do not run advertising trackers and do not integrate third-party advertising analytics.
For the full list of cookie categories, retention periods, third-party cookies, and management options, please refer to the "Cookie Policy" page.
6. Data Storage and Security
Your data is stored with cloud providers in the Asia-Pacific region (Supabase / AWS, Cloudflare R2, Qdrant Cloud) and protected by multiple layers including transport encryption, at-rest encryption, strict access control, and tenant isolation. The full description of infrastructure, encryption algorithms, application-layer defences, AI safety measures, payment security, and vulnerability reporting is provided on the "Data Security" page.
In the event of a personal data breach, we will notify affected individuals by appropriate means in accordance with the Personal Data Protection Act of the Republic of China (Taiwan) and take necessary remedial measures.
7. International Data Transfers
To provide the Service, some of your data may be transferred to regions outside the Republic of China (Taiwan) for processing and storage (including Japan, the United States, and other cloud service regions). We ensure these transfers comply with applicable data protection laws and require data recipients to provide adequate security protection measures.
8. Data Retention
We retain your data according to the following principles:
- Account Data: Retained for as long as your account exists. The Platform does not currently auto-delete accounts due to inactivity nor impose a maximum account lifetime. When an account is deleted (at your request or by us as permitted under these Terms), the related personal data is removed from the database immediately.
- User Content (knowledge documents, conversation records): Retained while your account exists. You may delete individual documents or conversations at any time within the platform; all related user content is removed together with the account upon deletion.
- External API conversation logs: Conversations made via the OpenAI-compatible external API are automatically purged 30 days later by a scheduled job; conversations conducted within the in-platform UI are not subject to this rotation.
- Payment Records: In accordance with the tax laws and business accounting regulations of the Republic of China (Taiwan), billing records may be retained for up to 7 years after account deletion.
- Usage Records and Analytics Data: De-identified aggregate data may be retained for longer periods for service improvement purposes.
- Backup Data: Data in system backups will be removed during the next backup rotation cycle.
9. Your Rights
In accordance with Article 3 of the Personal Data Protection Act of the Republic of China (Taiwan), you have the following rights regarding your personal data:
- Access and Review: You have the right to query and review your personal data held by the Platform.
- Request Copies: You have the right to request copies of your personal data.
- Supplement or Correct: You have the right to supplement or correct incomplete or inaccurate personal data.
- Request Cessation: You have the right to request the Platform to stop collecting, processing, or using your personal data.
- Request Deletion: You have the right to request deletion of your personal data. Please contact us at [email protected] for assistance (self-service account deletion is not yet available).
How to Exercise Your Rights: Please contact us at
[email protected]. We will respond within 30 days of receiving your request. In accordance with the Personal Data Protection Act, the Platform may charge necessary costs.
10. Children's Privacy
The Platform does not target its services to children under the age of 16. We do not knowingly collect personal data from children under 16. If we discover that we have inadvertently collected personal data from a child, we will promptly delete it. If you believe we may have collected data from a child, please contact us.
11. Google API Usage Disclosure
The Platform uses Google OAuth for authentication. Regarding the use of Google user data, we declare the following:
- We only obtain and use Google data necessary for account verification (name, email, profile picture).
- We do not use Google user data obtained through the API for AI model training or marketing purposes.
- The Platform's use of Google data complies with the Google API Services User Data Policy requirements.
12. AI Data Processing Notice
- Model Training: We do not use your User Content, conversation records, or personal data to train AI models. Your data is used solely to provide AI conversation services to you.
- Data Minimization: Data sent to third-party AI services (Google Gemini) is limited to document fragments necessary to answer specific questions, not your entire knowledge base content.
- Visitor Data: Conversations of visitors who interact with your AI assistant through share links are recorded and can be viewed in your conversation logs. Visitors are informed of this before use.
13. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. For significant changes, we will notify you via email or in-platform notifications. The modified policy takes effect upon publication. If you continue to use the Service after a policy change, you are deemed to have accepted the modified policy. We recommend reviewing this policy periodically.
This Cookie Policy explains how ShareYourAI ("the Platform") uses cookies and similar technologies when you use our website, applications, and shared pages. It should be read alongside our Privacy Policy.
1. What Are Cookies
Cookies are small text files that your browser stores on your device when you visit a website. They allow a site to remember your actions and preferences (such as login state and language choice) so you don't have to re-enter them on every visit. In addition to cookies, we also use similar browser-side technologies such as localStorage and sessionStorage; this policy refers to all of them collectively as "cookies".
2. Why We Use Cookies
We use cookies for the following purposes:
- Maintain your signed-in state so you don't have to re-enter your password
- Identify visitor sessions on shared pages so conversations stay continuous
- Remember your language preference, UI settings, and other customisations
- Protect the platform and users from CSRF, cross-site, and similar attacks
- Understand overall platform usage so we can improve features and reliability
3. Categories of Cookies We Use
Based on purpose and necessity, we group cookies into three categories. The examples below cover the main cookies currently in use; specific names and contents may change as the product evolves.
3.1 Strictly Necessary Cookies (cannot be disabled)
These cookies are required for the platform to operate. Without them the service would not function, so under applicable law they do not require your consent:
- Authentication token (HttpOnly, Secure, SameSite=Lax): identifies you as a signed-in member, valid for ~4 hours
- Refresh token (HttpOnly, Secure): silently extends your sign-in session, valid for ~14 days
- Website assistant visitor ID: keeps a visitor's conversation continuous across pages and reloads, valid for ~24 hours
- Shared page visitor session ID: used for usage quota counting and abuse protection, valid for ~7 days
- Shared page password verification: avoids re-entering the password each time a password-protected shared page is opened, valid for ~7 days
- Shared page privacy notice acknowledgement: records that a visitor has been shown the privacy notice so it does not reappear, valid for ~30 days (see Section 4 "Consent Model" below)
3.2 Functional Cookies
These cookies remember your preferences and improve the user experience. Disabling them does not affect core functionality:
- Language preference: remembers your locale (zh-TW / en) so it is applied automatically next time
- UI state: such as sidebar open/closed state, recently used features, etc.
- Browser localStorage: used for draft autosave inside the editor and similar local-only features
3.3 Analytics Cookies
We run our own first-party analytics to understand how the platform is used so we can spot friction and improve the experience:
- Event ID: links a single user's actions into a behavioural flow (hashed or anonymised)
- Page time and interaction events: clicks, scrolls, form submissions, etc.
- Technical environment: aggregated stats about browsers, OS, screen size, and similar information
We do not use third-party advertising trackers such as Google Analytics or Meta Pixel, and we never sell or share your browsing behaviour.
4. Consent Model (Implied Consent)
We currently operate under an implied-consent model. The model works as follows:
- We only use strictly necessary and functional cookies, and we do not run advertising trackers or third-party analytics scripts such as Google Analytics
- When a visitor first opens a shared page, a Cookie and Privacy notice banner appears at the bottom of the screen with links to the Cookie Policy and Privacy Policy; continued use constitutes consent to the full contents of both policies
- By continuing to use the service (signing in, starting a conversation, browsing a shared page) you are deemed to understand and accept the cookie practices described in this policy
- If you disagree with our cookie practices, please disable cookies in your browser as described in Section 7, or stop using the service
- If laws or our service evolve to require it, we will switch to an explicit-consent model and notify you accordingly
5. Third-Party Cookies
Some features rely on third-party providers that may set their own cookies. We do not directly control these cookies and recommend reviewing the relevant providers' privacy policies:
- Google OAuth: short-lived authentication cookies during the Google sign-in flow
- TapPay: secure cookies set by the payment processor during the payment flow, including 3D Secure verification
- Cloudflare: security and performance cookies as part of CDN and DDoS protection
- Font services (Google Fonts): for delivering web fonts
6. Cookie Duration
Depending on purpose, cookies fall into two categories:
- Session cookies: only valid while the browser tab is open and cleared when the browser closes
- Persistent cookies: stored on your device for a defined period, after which they expire automatically. Examples: auth token ~4 hours, refresh token ~14 days, language preference ~1 year
7. Managing or Disabling Cookies
You can manage cookies at any time using the following methods:
7.1 Browser settings
All major browsers let you view, delete, or block cookies. Refer to your browser's documentation for the exact path:
- Chrome: Settings → Privacy and security → Cookies and other site data
- Safari: Preferences → Privacy
- Firefox: Settings → Privacy & Security → Cookies and Site Data
- Edge: Settings → Cookies and site permissions
7.2 In-platform options
Signing out of your account clears the auth-related cookies. To delete your account along with all backend data, please contact us at [email protected] (self-service account deletion is not yet available).
7.3 What happens if you disable cookies
If you disable strictly necessary cookies, you will be unable to sign in or complete payments. Disabling functional or analytics cookies will mean some preferences are not remembered, but core functionality remains intact.
8. Do Not Track Signals
There is no industry-wide standard for honouring browser Do Not Track (DNT) signals, so the platform does not respond to DNT automatically. However, we do not use third-party advertising trackers, so your browsing behaviour is not shared with advertisers.
9. Changes to This Policy
This Cookie Policy may change as our service evolves or as regulations require. We will notify you of material changes via in-platform notice or email. Refer to the date at the top of this page for the latest update.
We treat security as part of the product, not as an afterthought. This page describes the technical and operational measures ShareYourAI uses to protect your account, knowledge content, and payment information.
1. Security Principles
Our security design follows five core principles:
- Least privilege: every component can access only the minimum data needed for its task
- Defence in depth: protections are applied at the transport, application, and data layers so a single failure is not catastrophic
- Secure by default: new features ship with the strictest settings and require an explicit choice to relax them
- Tenant isolation: a multi-tenant architecture strictly separates data between users
- Continuous verification: every request re-checks identity and permissions instead of relying on a single sign-in
2. Infrastructure & Hosting
We host on cloud providers with internationally recognised security certifications, with servers located in Asia-Pacific regions for compliance and low latency:
2.1 Application servers
The service runs on Google Cloud Run (asia-northeast1, Tokyo). Google operates the underlying physical and virtual infrastructure under ISO 27001, SOC 2, and PCI DSS standards.
2.2 Relational database
Account data, subscription records, and conversation history are stored on Supabase (PostgreSQL on AWS Tokyo) with daily backups, point-in-time recovery, and multi-AZ redundancy.
2.3 File storage
Uploaded documents, images, and avatars are stored in Cloudflare R2 object storage. Files are renamed using UUIDs, namespaced by user ID, and accessed via signed URLs.
2.4 Vector database
Document embeddings are stored in Qdrant Cloud. Each user has a dedicated Qdrant Collection named by user ID; cross-user queries are blocked at the database layer.
3. Encryption
3.1 In transit
All network traffic to and from the platform — browser, API, webhook — is forced over HTTPS / TLS 1.2+. We send HSTS headers to prevent downgrade attacks, and Cloudflare provides DDoS protection and edge encryption.
3.2 At rest
Cloud providers automatically encrypt all data at the storage layer:
- Supabase / AWS: AES-256 encryption for all database files and backups
- Cloudflare R2: AES-256 at-rest encryption for every object
- Qdrant Cloud: disk-level encryption
3.3 Sensitive material
Card and binding tokens are additionally AES-CBC encrypted before they reach our database. User passwords are stored using an industry-standard slow hash (salted PBKDF2-HMAC-SHA256) and cannot be reversed. API keys are kept only as SHA-256 hashes — once lost they can only be regenerated, never recovered.
4. Authentication & Access Control
We support multiple authentication methods and require identity verification for every API call:
- Google OAuth 2.0: sign-in goes through Google's official flow; we never see your Google password
- Two-factor authentication (2FA): mandatory TOTP-based 2FA on the admin console
- JWT tokens: short-lived access tokens paired with longer-lived refresh tokens; expired tokens require re-authentication
- HttpOnly cookies: all auth tokens are stored in HttpOnly + Secure + SameSite cookies, unreadable by frontend JavaScript to defend against XSS theft
- Granular API key permissions: each key can be limited to specific endpoints and quotas, and revoked at any time
5. Tenant Isolation
The platform is a multi-tenant SaaS. We isolate data between users in several layers:
- Database: every query is filtered by user ID, with ownership re-checked at the service layer
- Vector database: each user has a dedicated Qdrant Collection; cross-collection queries do not exist
- Object storage: R2 paths are prefixed with the user ID and gated by signed URLs
- Shared links: each link uses a cryptographically random token bound to its quota and GDPR consent record
6. Application-Layer Defences
Inside the application logic we apply several active defences:
- SQL injection: all database queries use parameterised statements (asyncpg $1, $2 style); string concatenation is forbidden
- XSS middleware: requests are scanned at the entry point for common XSS patterns and user content is sanitised again in the frontend before rendering
- CSRF protection: auth cookies use SameSite=Lax; sensitive actions require Origin verification
- Content Security Policy: scripts, styles, fonts, and outbound connections are restricted by allowlists
- Layered rate limiting: applied by endpoint sensitivity across session, API key, and visitor fingerprint layers to prevent brute force and abuse
- Input validation: every user input passes Pydantic schema and safe-string checks before reaching the service layer
- File uploads: limited by MIME type, size, and image dimensions, then renamed and stored in object storage
7. AI & Data Processing Safety
AI is core to our service, so we apply specific protections to the AI pipeline:
- Prompt isolation: system instructions and user input are kept strictly separate; user input cannot override core safety rules
- Output guardrail: AI responses go through two checks before they are sent (prompt-leak detection + hallucination risk evaluation)
- Knowledge boundary: the AI answers strictly from the knowledge you provide; if no match is found it says so rather than making things up
- Conversation health monitor: long conversations are monitored for semantic drift and can be steered back when needed
- No model training: your conversations and uploaded files are never used to train our or any third party's AI models
- LLM timeouts: every AI call has a strict timeout and falls back safely instead of waiting indefinitely
8. Payment Security
We never directly handle full card data. All card processing is done by PCI DSS compliant payment processors:
- Currently we use TapPay: a PCI DSS certified Taiwanese payment service provider, supporting 3D Secure verification, card binding / merchant-initiated charges (Pay by Prime / Pay by Token), transmitting card data via one-time Prime tokens and using Card Tokens for merchant-initiated charges
- We only store encrypted tokens returned by the processor and never see the full PAN
- Refunds, invoices, and reconciliation are integrated through the backend; sensitive payment fields are never exposed to the browser
- We may add or change PCI DSS compliant payment service providers from time to time and will notify you via in-platform announcement or email before any change takes effect
9. Monitoring & Incident Response
We continuously monitor the running system and have a defined process for handling incidents:
- Audit logs: admin actions, sign-in events, and payment transactions are logged and retained for review
- Error tracking: application exceptions trigger real-time alerts to the on-call engineer
- Performance monitoring: API response time, database query latency, and AI service timeout rate are continuously tracked
- Patch management: vulnerabilities are triaged by CVE severity, with critical issues patched within 24 hours
- Breach notification: in the event of a personal data breach, we will notify the relevant authority and affected individuals within a reasonable time, in line with Taiwan's Personal Data Protection Act and the GDPR
10. What You Can Do
Security is a shared responsibility. You can help protect your account by:
- Enabling two-factor authentication on your Google account
- Avoiding signed-in sessions on public devices and signing out when finished
- Reviewing your API keys regularly and revoking those you no longer use
- Setting passwords on shared links, or specifying which websites can embed them, to prevent uncontrolled redistribution
11. Safe Upload Practices
Content uploaded to your knowledge base may be referenced by the AI during conversations. If you create a public shared link, visitors can indirectly access uploaded content through chat. Please follow these principles:
- Do not upload documents containing personal sensitive information: copies of national ID, NHI card, credit cards (front/back), passport, bank statements, payslips, etc.
- Do not upload unfamiliar or unverified documents: they may contain malicious content or third-party personal data, creating legal and reputational risk
- Do not upload third-party data without authorization: employee records, customer lists, internal documents from partners without consent
- Do not upload trade secrets or NDA-bound content: tender documents, draft contracts, unpublished financials, etc.
- Shared links are public — anyone with the link can interact with the AI, and the AI may reference uploaded content in its responses
- For any private, sensitive, or non-public document, always set a password when creating a shared link; we recommend upgrading to Pro or higher for password protection, or upgrading to the Business plan for Email-restricted access (only the people you specify can view), and redact or remove sensitive fields before uploading
- This platform applies multi-layer sensitive-data detection and masking on AI conversations, but managing source content is still the most effective safeguard
If you are uncertain whether a document is appropriate to upload, please consult your organization's compliance or information security team.
12. Vulnerability Reporting